docs: document manager terminal and file workflows in both languages

docs/README.md

@@ -11,6 +11,7 @@ Framely manages plugins on Steam Frame through device services, a SteamVR interf
 3. [Install and manage plugins](user-guide/plugins.md): plugin library, sources, subscriptions, local packages and updates.
 4. [Network panel](user-guide/network-panel.md): address, first password setup, login and phone/desktop access.
 5. [APK Manager](user-guide/apk-manager.md): sideload installation, updates, containers, retained data and cleanup.
+6. [Terminal and files](user-guide/terminal-and-files.md): user-owned terminal sessions, file operations, recycle bin, transfers and previews.
 
 ## Plugin development and publishing
 

docs/user-guide/basic-usage.md

@@ -11,9 +11,9 @@ Click Framely in the SteamVR Dashboard Dock. First use requires accepting the te
 - **Favorites**: open favorite plugin quick pages.
 - **Installed**: browse enabled local plugins and their pages.
 - **Notifications**: view saved notifications and update reminders, and toggle floating notifications.
-- **Settings**: choose an installed language, toggle safe mode, open the plugin manager or **Check for updates**. The update entry opens the manager’s About/update page. Install language files and download the language template from the manager’s Settings page.
+- **Settings**: choose an installed language, toggle safe mode, open the plugin manager or **Check for updates**. The update entry opens the manager’s Settings → Updates page. Install language files and download the language template from the manager’s Settings page.
 
-The manager opens a separate large window with navigation for plugins, plugin library, sources, settings, notification settings and About. Installation, updates and source management happen here. A phone or computer can also use the [network panel](network-panel.md).
+The manager opens a separate large window with five sections: Plugin, APK, Terminal, Files and Settings. Installation, updates and source management happen here. A phone or computer can also use the [network panel](network-panel.md).
 
 ## Plugins and windows
 
@@ -25,11 +25,11 @@ Dock windows use SteamVR close controls. Temporary windows may be destroyed when
 
 Settings provides language, network panel and proxy configuration. HTTP and GitHub proxies have independent switches; saving an address does not automatically enable it.
 
-Safe mode pauses third-party plugins for troubleshooting; leave it after resolving the problem. About shows the device version, updates and terms. Revoking consent disables all plugins; accepting again does not automatically re-enable them.
+Safe mode pauses third-party plugins for troubleshooting; leave it after resolving the problem. Settings → About shows the device version and terms; Settings → Updates manages updates. Revoking consent disables all plugins; accepting again does not automatically re-enable them.
 
-In About, select the Stable or Testing update channel and check for updates. Choose **Download and install**, then confirm once: Framely downloads and verifies the release and automatically starts installation. Download and verification are displayed as separate stages, with byte progress for each. Download or verification failure stops installation and displays an error. Plugins and data remain; the Framely interface briefly closes and restarts.
+In Settings → Updates, select the Stable or Testing update channel and check for updates. Choose **Download and install**, then confirm once: Framely downloads and verifies the release and automatically starts installation. Download and verification are displayed as separate stages, with byte progress for each. Download or verification failure stops installation and displays an error. Plugins and data remain; the Framely interface briefly closes and restarts.
 
-Automatic update checks are enabled by default. Framely checks about 30 seconds after starting (once terms are accepted), then every 6 hours. In About, turn **Check for updates automatically** off or change the interval. Checks use the selected Stable/Testing channel and configured proxy, continue with the panel closed, and never download or install automatically. A newer version saves a notification to the inbox and shows a popup when notification settings allow it. **Ignore** dismisses that version's reminder; **Open updates** opens About's update page. The same version is not repeatedly announced, including after restart. Switching the source or channel clears the old reminder.
+Automatic update checks are enabled by default. Framely checks about 30 seconds after starting (once terms are accepted), then every 6 hours. In Settings → Updates, turn **Check for updates automatically** off or change the interval. Checks use the selected Stable/Testing channel and configured proxy, continue with the panel closed, and never download or install automatically. A newer version saves a notification to the inbox and shows a popup when notification settings allow it. **Ignore** dismisses that version's reminder; **Open updates** opens Settings → Updates. The same version is not repeatedly announced, including after restart. Switching the source or channel clears the old reminder.
 
 Floating notifications follow the headset near the upper-right of the view. Their input mask matches the visible card; short button clicks tolerate small tracking movements.
 

docs/user-guide/network-panel.md

@@ -35,3 +35,5 @@ Change the port or switch in Settings → Network panel. Password/authentication
 Restarting the session service also invalidates old logins. Saving identical settings retains the session. Incorrect password checks are rate-limited; retry later when asked.
 
 If unreachable, check changing device IPs, network reachability, enabled state and port. Settings and passwords live in `/home/.framely/state` and are retained by uninstall; reinstalling may still require the old password.
+
+The top switcher provides Plugin, APK, Terminal, Files and Settings; the device address defaults to Plugin. [Terminal and files](terminal-and-files.md) provides user-owned shell sessions, uploads/downloads, editing, archives and previews. These tools use the same login and port.

docs/user-guide/terminal-and-files.md

@@ -0,0 +1,57 @@
+# Terminal and files
+
+[简体中文](../zh-CN/user-guide/terminal-and-files.md)
+
+[Documentation](../README.md) · [Network panel](network-panel.md)
+
+## Manager navigation
+
+The top switcher contains **Plugin / APK / Terminal / Files / Settings**. Opening the device IP without a fragment starts in Plugin. Each section remembers its last subpage in the browser. Existing `#settings`, `#launcher-settings`, `#about` and `#updates` links continue to work.
+
+Plugin contains installed plugins, the plugin library, sources and notification settings, including Framely's notifications. Plugin-specific settings remain in each plugin's management dialog. APK keeps its apps, containers and retained-data cleanup. Settings contains General, Launcher, Updates and About.
+
+## Terminal
+
+Create a terminal to open the configured Steam session user's login shell in their home directory, normally `steamos`. This is a real PTY: Ctrl-C, Tab completion, arrows, Unicode input, window resizing and full-screen programs such as Vim and top work. Use `sudo` inside the terminal when administrator privileges are needed; the panel password is separate from the user's sudo password.
+
+You can create up to 12 sessions, rename them, reconnect or explicitly close them. Changing pages, closing a browser or losing the network leaves the shell running. Restarting the user-session service or Framely ends the sessions; processes are not restored after restart. Closing a session requires confirmation and releases the shell, its session's child processes and PTY.
+
+Only one connection can type in a session. Other connections are read-only; **Take control** transfers input ownership. While disconnected, input is disabled. Reconnection never replays queued keystrokes and restores only the retained output. Each session has a 2 MiB output buffer; a notice appears when older output was discarded. Replayed raw terminal output can lose earlier screen context after truncation.
+
+Terminal input, sudo passwords and output are not written to Framely logs. Output is rendered as terminal characters, not HTML; terminal clipboard-write escape sequences are ignored. xterm.js and its fit addon are included with the offline UI, without CDN requests.
+
+## Browse and organize files
+
+Files opens the user's home directory and accesses the filesystem with that user's permissions. It never automatically elevates privileges. Permission changes are limited to ordinary Unix permission bits; use Terminal and `sudo` for administrator operations.
+
+Use the address bar, breadcrumbs, parent button or expandable folder tree. Quick access includes Home, Downloads, mounted storage, the filesystem root, the recycle bin and your saved folders. Add the current folder using the star button; rename, reorder or remove its shortcut with the adjacent controls. Unavailable folders keep their saved shortcut and display the access error when opened.
+
+The file list provides hidden-file visibility, sorting, checkboxes for multiple selection, current-folder filtering and cancellable recursive filename search. Recursive search does not follow directory links. Lists are paged in groups of 200; recursive results are limited to 5,000 matches and 500,000 visited entries. Media contents are never scanned to create thumbnails.
+
+**Actions** provides copy, cut, paste, rename, delete, properties, permission editing, compression, extraction and opening files. Right-click selects a file and opens these actions. Symbolic links have an arrow marker and their target in Properties. Copy preserves links; deleting a link does not delete its target. Special filesystem objects cannot be copied or archived.
+
+Copy, move, upload and extraction let you skip conflicts, keep both names or confirm replacement for the batch. Replacement of a same-name folder replaces that whole folder; it does not merge its contents. Long tasks show actual bytes or completed entries, can be cancelled, and report individual failures. Completed items remain completed when a later item fails or the task is cancelled. Switching manager sections keeps active file work and editor state in the current page.
+
+## Recycle bin
+
+Delete defaults to **Move to recycle bin (30 days)**. Permanent deletion requires an explicit choice and confirmation. Framely keeps trash on the source filesystem: home-directory trash or a private `.framely-trash-UID` directory at the storage mount. If that storage cannot support trash, the operation reports an error and does not fall back to permanent deletion.
+
+The recycle bin supports restoring with an unused name or keeping both copies, permanent removal and clearing all tracked items. Restore needs the original parent directory to exist. Framely cleans expired records about hourly while the session service runs, and only removes items recorded in its own recycle bin. Unavailable storage is retained until accessible again. Other applications' trash is unaffected.
+
+## Transfer and edit
+
+Upload multiple files or a folder from your browser. Transfers use 1 MiB chunks, byte progress and private temporary files; only a completed upload receives its final filename. Cancelled uploads are removed and hourly maintenance removes transfers idle for at least an hour. A stopped service may leave clearly named `.framely-upload-*` temporary files, never a falsely complete final file. Uploads are limited to 64 GiB per file and 64 simultaneous transfer records.
+
+Download a single file directly, or select multiple files/folders to download a ZIP. Download links expire after an hour. Large files stream without loading the entire file into memory; single-byte ranges support video seeking and resuming downloads.
+
+Opening an ordinary file attempts the UTF-8 editor, limited to 5 MiB. Invalid UTF-8, binary data and larger files cannot be edited; use Download instead. Saving checks a content revision. External changes require reloading the file or explicitly confirming overwrite. Unsaved changes require confirmation before closing the editor.
+
+## Archives and media
+
+Create ZIP, TAR or TAR.GZ archives; the output filename selects the format. Choose a destination and conflict behavior when extracting. Archive operations reject absolute paths, parent traversal, symbolic/hard links and special files; extracted contents are never executed. Archive limits are 50,000 entries and 64 GiB expanded data. Cancelling removes staging files and leaves already committed items intact.
+
+Select an image or video to preview it. PNG, JPEG, GIF, WebP, AVIF, BMP, MP4, WebM and MOV use the browser's native decoder; actual codec support depends on the browser. Video controls provide playback, seeking and fullscreen. Unsupported formats can be downloaded; there is no server-side transcoding. HTML and SVG are not opened as same-origin pages.
+
+## Access and privacy
+
+Terminal, file and transfer routes use the existing authenticated manager connection and port. Mutating routes and the terminal WebSocket require an exact matching Origin; plugin sandboxes cannot use them. The service runs as the configured Steam user, independently of the root daemon. Preview/download content is read only after explicit selection. Test media are generated fixtures; Framely does not automatically read or upload Arcturus recordings.

docs/zh-CN/README.md

@@ -13,6 +13,7 @@ Framely 是 Steam Frame 的插件管理器，包含设备端服务、SteamVR 界
 3. [安装与管理插件](user-guide/plugins.md)：插件库、来源、订阅、本地包和更新。
 4. [网络管理面板](user-guide/network-panel.md)：地址、首次密码、登录、手机/电脑使用。
 5. [APK 管理](user-guide/apk-manager.md)：侧载安装、更新、容器、保留数据与清理。
+6. [终端与文件](user-guide/terminal-and-files.md)：用户终端会话、文件操作、回收站、传输与预览。
 
 ## 插件开发与发布
 

docs/zh-CN/user-guide/basic-usage.md

@@ -11,9 +11,9 @@
 - **常用**：打开收藏的插件快捷页。
 - **已安装**：查看已启用的本机插件，进入插件页面。
 - **通知**：查看收件箱消息和更新提醒，并控制悬浮通知。
-- **设置**：选择已安装的语言、切换安全模式，或打开“管理插件”和“检查更新”。“检查更新”打开管理窗口的关于／更新页面；安装语言文件和下载语言模板在管理窗口的设置中进行。
+- **设置**：选择已安装的语言、切换安全模式，或打开“管理插件”和“检查更新”。“检查更新”打开管理窗口的设置 → 更新页面；安装语言文件和下载语言模板在管理窗口的设置中进行。
 
-“管理插件”打开独立大窗口，左侧导航进入插件、插件库、插件源、设置、通知设置和关于。安装、更新及来源管理在这里完成；电脑或手机也可使用[网络管理面板](network-panel.md)。
+“管理插件”打开独立大窗口，顶部进入插件、APK、终端、文件与设置五个区域。安装、更新及来源管理在这里完成；电脑或手机也可使用[网络管理面板](network-panel.md)。
 
 ## 插件启停与窗口
 
@@ -25,9 +25,9 @@
 
 设置中可修改语言、网络面板及代理。HTTP 代理和 GitHub 代理各有开关，保存地址不会自动启用代理。
 
-“安全模式”暂停第三方插件，适合出现故障时检查；排查后再退出安全模式。在“关于”查看本体版本、检查更新和复查协议。撤回协议会停用全部插件，再次同意后需要手动启用。
+“安全模式”暂停第三方插件，适合出现故障时检查；排查后再退出安全模式。在“设置 → 关于”查看本体版本和协议，在“设置 → 更新”检查更新。撤回协议会停用全部插件，再次同意后需要手动启用。
 
-在“关于”选择正式版或测试版渠道并检查更新，点击“下载并安装”并确认一次：Framely 下载、校验发行包后自动开始安装。下载和校验分别显示阶段提示与实际字节进度。下载或校验失败时停止安装并显示原因。插件和数据保留，Framely 界面会暂时关闭并重新启动。
+在“设置 → 更新”选择正式版或测试版渠道并检查更新，点击“下载并安装”并确认一次：Framely 下载、校验发行包后自动开始安装。下载和校验分别显示阶段提示与实际字节进度。下载或校验失败时停止安装并显示原因。插件和数据保留，Framely 界面会暂时关闭并重新启动。
 
 日志排查命令见[安装指南](installation.md#修复与日志)。界面能打开不代表所有插件都正常；先逐个启用，确认运行身份与来源可信。
 
@@ -41,7 +41,7 @@
 
 管理窗口的“通知设置”提供全局“悬浮通知”和“启动图标角标”开关，并为 Framely 本体（包括更新提醒）及所有已安装插件（包括已停用插件）提供独立的“角标”和“悬浮”开关。全局开关优先，关闭后仍保留各应用偏好。Framely Dock 启动图标的角标统计允许显示角标来源的未读收件箱消息，超过 99 显示 `99+`；实际打开通知标签后消除角标，隐藏的头显面板不会自动标记已读。查看消息不会删除消息，也不会关闭其操作按钮。设置和已读状态均会保存并在重启后恢复。
 
-本体默认在启动约 30 秒后检查更新（须已接受用户协议），之后每 6 小时检查一次；面板关闭时也会继续检查。可在管理窗口“关于”的更新页关闭自动检查或修改间隔。自动检查遵循所选正式版/测试版渠道及代理配置，只检查并提醒，不会自动下载或安装。
+本体默认在启动约 30 秒后检查更新（须已接受用户协议），之后每 6 小时检查一次；面板关闭时也会继续检查。可在管理窗口“设置 → 更新”关闭自动检查或修改间隔。自动检查遵循所选正式版/测试版渠道及代理配置，只检查并提醒，不会自动下载或安装。
 
 发现较新版本后会将提醒保存在收件箱，通知设置允许时同时显示浮窗。“忽略”关闭并移除此版本提醒，同一版本在重启后也不会重复提醒；“打开更新”直接打开管理窗口的更新页面。更改更新源或渠道会清除旧提醒。
 

docs/zh-CN/user-guide/network-panel.md

@@ -35,3 +35,5 @@ VR 窗口、手柄振动和 SteamVR 虚拟键盘需要头显端验收；浏览
 会话服务重启也会使旧登录失效，需要重新登录。保存完全相同的设置不会撤销当前会话。错误密码验证有速率限制，提示尝试过多时稍后再试。
 
 无法访问时检查设备 IP 是否变化、两台设备是否处于可互通的网络、面板是否开启以及端口是否正确。设置/密码保存在 `/home/.framely/state`，卸载本体保留这些状态，重装后可能仍需原密码。
+
+顶部切换器提供插件、APK、终端、文件与设置；设备地址默认打开插件。[终端与文件](terminal-and-files.md)提供用户 Shell 会话、上传下载、编辑、压缩及预览，复用相同登录和端口。

docs/zh-CN/user-guide/terminal-and-files.md

@@ -0,0 +1,57 @@
+# 终端与文件
+
+[English](../../user-guide/terminal-and-files.md)
+
+[文档索引](../README.md) · [网络面板](network-panel.md)
+
+## 管理面板导航
+
+顶部切换器为 **插件 / APK / 终端 / 文件 / 设置**。直接访问设备 IP 默认进入插件；各区域在当前浏览器中记住上次子页面。原有 `#settings`、`#launcher-settings`、`#about`、`#updates` 链接继续有效。
+
+插件区域包含已安装插件、插件库、来源和通知设置，通知仍包含 Framely 本体；插件自身设置位于对应插件的管理弹窗。APK 保留应用、容器及数据清理。设置集中放置通用、启动台、更新和关于。
+
+## 终端
+
+新建终端会以安装时配置的 Steam 会话用户打开登录 Shell，初始目录为该用户主目录，通常是 `steamos`。真实 PTY 支持 Ctrl-C、Tab 补全、方向键、中文、尺寸调整，以及 Vim、top 等全屏程序。需要管理员权限时在终端使用 `sudo`；面板访问密码与 sudo 密码不同。
+
+最多创建 12 个会话，支持改名、重连及明确关闭。切换页面、关闭浏览器或断网不结束 Shell；用户会话服务或 Framely 重启后结束，不恢复进程。关闭须确认，并回收 Shell、属于该 Unix 会话的子进程及 PTY。
+
+同一会话只允许一个连接输入，其他连接只读；“接管控制”转移输入权限。断网时禁止输入，重连不重放按键，仅恢复保留输出。每个会话缓存上限 2 MiB，截断旧输出时显示提示；重放截断后的原始终端数据可能缺少此前屏幕上下文。
+
+终端输入、sudo 密码及输出不写入 Framely 日志。输出作为终端字符渲染，不执行 HTML，忽略写剪贴板的转义请求。xterm.js 和尺寸适配依赖随离线包提供，不使用 CDN。
+
+## 浏览与整理文件
+
+默认打开用户主目录，以该用户权限访问文件系统，不自动提权。权限编辑仅支持普通 Unix 权限位；管理员操作请使用终端里的 `sudo`。
+
+通过地址栏、面包屑、上级按钮或可展开文件夹树导航。快速访问包含主目录、下载、挂载存储、文件系统根目录、回收站及自定义文件夹。星标按钮添加当前目录，旁边按钮可改名、排序、移除；暂不可用的目录保留记录，打开时显示访问错误。
+
+文件列表支持隐藏文件、排序、多选、当前目录过滤及可取消的递归文件名搜索。递归搜索不跟随目录链接；列表每页 200 项，递归搜索最多返回 5,000 个匹配项、访问 500,000 项。不扫描媒体内容生成缩略图。
+
+“操作”提供复制、剪切、粘贴、重命名、删除、属性、权限修改、压缩、解压及打开。右键选择文件并展开操作。符号链接显示箭头，属性显示目标；复制保留链接，删除链接不会删除目标。特殊文件不能复制或压缩。
+
+复制、移动、上传、解压可按批次选择跳过、保留两份或明确确认覆盖。同名文件夹覆盖会替换整个文件夹，不合并内容。长任务显示真实字节或已完成条目，可取消并逐项报告错误；后续失败或取消不撤销已完成的项目。在当前网页内切换区域会保留文件任务及编辑状态。
+
+## 回收站
+
+删除默认选择“移至回收站（30 天）”，永久删除须主动选择并确认。回收站保存在原文件系统内：主目录回收站，或存储挂载点的私有 `.framely-trash-UID` 目录。存储无法支持回收站时报告错误，不自动改成永久删除。
+
+支持恢复到空闲名称或保留两份、永久删除及清空已登记项目。恢复要求原父目录存在。用户会话服务运行时约每小时检查到期项目，只清理 Framely 登记的回收站文件；存储离线时保留记录，恢复访问后再处理。不影响其他应用的回收站。
+
+## 传输与编辑
+
+网页可上传多个文件或文件夹，使用 1 MiB 分块和字节进度，先写私有临时文件，完成后才获得最终文件名。取消会移除临时文件，约每小时清理闲置至少一小时的上传。服务被强行停止可能留下明确命名的 `.framely-upload-*` 临时文件，不会冒充完整结果。每个文件最大 64 GiB，同时最多保存 64 条上传记录。
+
+单文件可直接下载，多选文件或文件夹以 ZIP 下载；下载链接一小时后失效。大文件流式传输，单段 Range 请求支持视频拖动和下载续传。
+
+普通文件打开时尝试 UTF-8 文本编辑器，上限 5 MiB；非法编码、二进制或超大文件无法编辑，可下载后处理。保存校验内容版本，外部修改后须重新加载或确认覆盖。关闭未保存内容会要求确认。
+
+## 压缩与媒体
+
+支持创建 ZIP、TAR、TAR.GZ，输出文件名决定格式。解压时选择目标目录和冲突策略。拒绝绝对路径、向上路径穿越、软硬链接及特殊文件，不执行解压内容；最多 50,000 项、展开大小 64 GiB。取消会清理暂存文件，保留已经提交的项目。
+
+选择图片或视频后才读取内容预览。PNG、JPEG、GIF、WebP、AVIF、BMP、MP4、WebM、MOV 使用浏览器原生解码，具体编码支持取决于浏览器；视频提供播放、暂停、拖动及全屏。不支持的格式提示下载，不转码。HTML、SVG 不作为同源页面打开。
+
+## 访问与隐私
+
+终端、文件与传输使用现有管理面板登录和端口；修改接口及终端 WebSocket 严格匹配 Origin，插件沙箱不可调用。接口运行于 Steam 用户会话服务，不借用 root 本体执行文件操作。预览与下载仅在用户主动选择后读取内容；测试媒体为生成的样本，不自动读取或上传 Arcturus 录制文件。